IPv6 router configuration

Transcription

1 IPv6 router configuration Port Elizabeth, South Africa 2005 János Mohácsi NIIF/HUNGARNET Copy Rights This slide set is the ownership of the 6DISS project via its partners The Powerpoint version of this material may be reused and modified only with written authorization Using part of this material must mention 6DISS courtesy PDF files are available from 2

2 Contributions Main authors János Mohácsi, NIIF/HUNGARNET, Hungary Laurent Toutain, ENST-Bretagne IRISA, France Contributors Octavio Medina, ENST-Bretagne, France Mohsen Souissi, AFNIC, France Vincent Levigneron, AFNIC, France Thomas Noel, LSIIT, France Alain Durand, Sun Microsystems, USA Alain Baudot, France Telecom R&D, France Bill Manning, ISI, USA David Kessens, Qwest, USA Pierre-Emmanuel Goiffon, Renater, France Jérôme Durand, Renater, France 3 Equipment Configuration routers 4

3 Equipment Configuration CISCO JUNIPER 6WIND FreeBSD Debian Microsoft (Windows XP) Zebra 5 Cisco IOS Roadmap: IOS upgrade = Free IPv6 IOS Release Phase I IOS 12.2(5)T 12.2(14)S Done Market Target Early Adopter Deployment Phase II Done Production Backbone Deployment Phase III ongoing Enhanced IPv6 Services 6

4 Cisco IOS IPv6 Phase I IPv6 unicast routing ICMPv6 support IPv6 ND Static ND entry SLAAC Path MTU discovery CEF RIPng Static Route IS-IS (only SP images) BGP4+ Basic ACLs IPv6 in IPv4 tunnel 6to4 tunnel Ethernet ATM FDDI Frame-Relay PPP/HDLC VLAN 7 Phase 1 supported platforms Cisco IOS 12.2T Cisco 800 series routers Cisco 1400 series routers Cisco 1600 series routers Cisco 1700 series routers Cisco 2500 series routers (12.2(4)T only) Cisco 2600 series routers Cisco IOS 12.0ST Cisco IOS 12.2B Cisco 3600 series routers Cisco series routers Cisco 7400 series routers Cisco 4500/4700 series Cisco IOS 12.2S Cisco IPv6 EFT only routers (12.2(2)T only) Cisco 7200 series routers AS5300, 5400 Cisco 7100 series Cisco 7500 series routers routers Cisco 7600 series routers Cisco 7200 series (limited release) routers Catalyst 6500 series (limited Cisco 7500 series routers release 8

5 Cisco IOS IPv6 Phase II i/is-is OSPFv3 CEF/dCEF AAA/Dial (B train) Extended Access List IPv6 over IPv4 GRE tunnels NAT-PT IPv6 Edge router (6PE) over MPLS DNS AAAA client CDP SSH IPv6 MIB (only vendor specific!) GSR/12000 support Cat6k - support 9 Cisco IOS IPv6 Phase III IPsec: Authentication required by OSPFv3, (12.3(7)T) Policy based routing Mobile IPv6: Home Agent prototype Mobile IPv6 router Mobile IP Binding Association Router renumbering NetworkManagement IPv6 Multicast: MLD, PIMv6 SM, PIM SSM IPv6 QoS: (Diff. Serv. & RSVP) Netflow v9: IPv6 statistics such as IPv6 Src/Dst addresses, AS number & Bytes count Tunnels: IPv6 over IPv6, IPv4 over IPv6 tunnels, ISATAP Hardware acceleration: in progress 10

6 Cisco IOS IPv6 Phase III/2 Additional encapsulation: IPv6 over DPT, Cable and DSL DHCPv6: stateless, prefix delegation and relay Multicast IPv6: BGP, Scope, BSR SNMP: over IPv6 IOS Firewall Future enhancements: EIGRP Mobile ACL extensions - done HSRPv6 Mobile IPv6 extensions 11 Cisco series router IPv6 IPv6 Basics ICMPv6 ND including static entries Stateless Auto-config. ACL MIBs, SSH, Telnet DNS, TFTP Routing protocols RIPng, IS-IS for IPv6, OSPFv3, MP- BGP4 IPv6 Tunnels distributed on Line cards or Tunnel Card Switching dcefv6 6PE (IPv6 over MPLS) Feature set on 12.0(25)S IPv6 Hardware Assistance Engine 3 Line Cards 4 x GE ATM OC-12 POS OC-3, OC-12, OC-48 Standard & Extended ACL Including simultaneous IPv6 Option Headers & UDP/TCP port parsing IPv6 Provider Edge (6PE) over MPLS up to 3.8Mpps per LC CY03 Multicast IS-IS MT 26S Radar 12

7 Cisco 7600/Cat series IPv6 IPv6 Basics ICMPv6 ND including static entries Stateless Auto-config. ACL MIBs, SSH, Telnet DNS, TFTP Routing protocols RIPng, IS-IS for IPv6, MP-BGP4 IPv6 Tunnels Configured, automatic, GRE, 6to4, ISATAP Switching CEFv6 6PE (IPv6 over MPLS) Feature set on 12.2SX IPv6 Hardware Assistance Supervisor Engine 720 IPv6 hardware assisted forwarding native IPv Mpps IPv6 over IPv4 tunnels - 10Mpps dcef720 (PFC3) modules ie: 10GE +200 Mpps FY04 Multicast IS-IS MT OSPFv3 Sync with 12.2S RLS3-12.2(17b)SXA Sup.2/MSFC2 Software Forwarding 13 Cisco Catalyst 3750 Series Switches Feature set inherited from 12.2S in CY E release based at FCS Update to 12.2S later, adding IPv6 support IPv6 Hardware Assistance Investment protection Requires extra license 14

8 CISCO configuration - basics Enable IPv6 on an interface interface xxxxx ipv6 enable Configure an address interface xxxxx ipv6 address X:X:X:X::X/<0-128> (general address) ipv6 address X:X:X:X::X (link-local address) ipv6 address autoconfig (auto-configuration) e.g. LAN Interface interface Ethernet0/0 ip address ipv6 address 2001:db8:123:1::2/64 15 CISCO configuration - tunnel Configure an IPv6 in IPv4 tunnel interface tunnel x tunnel source interface tunnel destination X.X.X.X ipv6 address X:X:X:X::X/<0-128> tunnel mode ipv6ip (for direct tunneling) tunnel mode gre ip (for gre encapsulation) 16

9 CISCO configuration tunnel2 Configure an IPv6 in IPv6 tunnel interface tunnel x tunnel source interface tunnel destination X:X:X:X::X ipv6 address X:X:X:X::X/<0-128> tunnel mode ipv6 (for direct tunneling) tunnel mode gre ipv6 (for gre encapsulation) 17 CISCO configuration - routing Enable IPv6 routing ipv6 unicast-routing Configure static routes ipv6 route prefix/prefixlen next_hop Ex: ipv6 route ::/0 2001:db8:10a:1001::1 18

10 Cisco configuration OSPFv3 interface Ethernet0/0 ipv6 address 2001:db8:1:1::1/64 ipv6 ospf 1 area 0! interface Ethernet0/1 ipv6 address 2001:db8:1:2::2/64 ipv6 ospf 1 area 1! ipv6 router ospf 1 router-id Area 1 Eth0/1 ABR Eth0/0 Area 0 19 CISCO configuration - BGP BGP configuration no bgp4 default unicast bgp router-id a.b.d.f router bgp xxxx neighbor X:X:X:X::X remote-as neighbor X:X:X:X::X address-family ipv6 neighbor X:X:X:X::X activate neighbor X:X:X:X::X network 2001:db8::/32 no synchronization exit address-family 20

11 CISCO configuration policy filtering Routing policy filtering ipv6 prefix-list bgp-in-6net seq 5 deny ::/0 -> Means filter ::/0 exactly ipv6 prefix-list bgp-in-6net seq 10 deny 3FFE:300::/24 le 28 ipv6 prefix-list bgp-in-6net seq 15 deny 2001:db8::/35 le 41 ipv6 prefix-list bgp-in-6net seq 20 permit 2002::/16 ipv6 prefix-list bgp-in-6net seq 25 permit 3FFE::/17 ge 24 le 24 ipv6 prefix-list bgp-in-6net seq 30 permit 3FFE:8000::/17 ge 28 le 28 -> Means every prefix matching 3FFE:8000::/17 with length 28 ipv6 prefix-list bgp-in-6net seq 35 permit 3FFE:4000::/18 ge 32 le 32 ipv6 prefix-list bgp-in-6net seq 40 permit 2001::/16 ge 32 le 35 -> Means every 2001::/16 derived prefix, with length between 32 and Cisco configuration - ACLs ACL ipv6 access-list vty-ipv6 permit tcp 2001:db8:0:401::/64 any eq telnet deny ipv6 any any log-input Applying an ACL to an interface ipv6 traffic-filter <acl_name> in out Restricting access to the router ipv6 access-class <acl_name> in out Applying an ACL to filter debug traffic debug ipv6 packet [access-list <acl_name>] [detail] 22

12 Cisco Show Commands show bgp show bgp ipv6 unicast/multicast/all summary show bgp ipv6 neigh <addr> routes show bgp ipv6 neigh <addr> advertised-routes show bgp ipv6 neigh <addr> received-routes show ipv6 route show ipv6 interface show ipv6 neighbors 23 Cisco references /ps6553/products_ios_technology_hom e.html 24

13 Juniper IPv6 support - now No Special code, uniform on all platform Addressing and forwarding H/W forwarding Addressing (link, global, Neighbour discovery) Stateless autoconfiguration Routing BGP4+, IS-IS, OSPFv3, RIPng, Static Operation telnet, ssh, ping traceroute,icmpv6 H/W based firewall filter urpf check Deployment Dualstack, configured tunnel, L3 MPLS VPN 25 Juniper IPv6 support now+future IPv6 Multicast: BGP, PIMv2 support with RP support, SSM (now) EBGP peering with linklocal address - simplification for IPv6 IX (now) IPv6 over MPLS (now) IPv6 flow monitoring 26

14 Juniper configuration - basics Interface configuration interfaces { name_of_interface { unit x { family inet { address X.X.X.X/prefixlength; } family iso { address Y.Y.Y.Y.Y.Y; } family inet6 { address Z:Z:Z:Z::Z/prefixlength; Cannot autoconfigure the router interfaces 27 Juniper configuration - tunnels Router advertisements (stateless autoconf) protocols { router-advertisement { interface interface-name { prefix IPv6_prefix::/prefix_length; Configure tunnel (with Tunnel PIC) interface{ ip-x/x/x { tunnel { source ipv4_source_address; destination ipv4_destination_address; } family inet6 { address ipv6_address_in_tunnel/prefixlength gr-x/y/z { unit 0 {...}} }}} 28

15 Juniper configuration static routing Static routes routing-options { rib inet6.0 { -> Means IPv6 unicast routing table static { route IPv6_prefix next-hop IPv6_address; } routing-options { rib inet6.0 { static { route IPv6_prefix discard; -> Useful to originate a network } 29 Juniper configuration - OSPFv3 protocols { ospf3 { } } preference 20; area { } interface ge-0/3/0.808 { } metric 100; interface lo0.0 { } passive; 30

16 Juniper configuration - BGP BGP configuration brotocols { bgp { local-as local_as_number; group EBGP_peers { type external; family inet6 { (any multicast unicast) } neighbor neighbor_ipv6_address; peer-as distant_as_number; import in-ps; export out-ps; } 31 Juniper configuration policy routing Policy statements policy-statement in-ps { term from_outside_accept { from { route-filter 2002::/16 exact; route-filter 3FFE::/17 prefix-length-range /24-/24; route-filter 3FFE:8000::/17 prefix-length-range /28- /28; route-filter 3FFE:4000::/18 prefix-length-range /32- /32; route-filter 2000::/3 prefix-length-range /16-/16; route-filter 2001::/16 prefix-length-range /29-/35; } then { accept; } then reject; } 32

17 Juniper Show Commands show bgp summary show route advert bgp <addr> show route rece bgp <addr> show route table inet6.0 (terse) show interfaces show ipv6 neighbors 33 6WIND Interface Configuration Enter Ethernet Private Interface Context hurricane{myconfig} eth0_0 hurricane{myconfig-eth0_0} Set IP Address hurricane{myconfig-eth0_0} ipaddress /24 hurricane{myconfig-eth0_0} ipaddress 3ffe:10::beef/48 Advertise an IPv6 prefix hurricane{myconfig-eth0_0} prefix 3ffe:10::beef:f00d::/64 34

18 6WIND (2) Migration configuration Enter Migration Context hurricane{myconfig} mig hurricane{myconfig-mig} Create 6in4 interface hurricane{myconfig-mig} 6in ffe:1::10 3ffe:1::20 Create 4in6 interface hurricane{myconfig-mig} 4in6 0 3ffe:1::10 3ffe:1:: Create 6to4 interface hurricane{myconfig-mig} 6to WIND (3) Migration configuration Create ISATAP interface hurricane{myconfig-mig} isatap_router hurricane{myconfig-mig} isatap_prefix :101:10a::/64 Create DSTM interface hurricane{myconfig-mig} dstm eth0_0 36

19 6WIND (4) Static Routing Configuration Enter Routing Context hurricane{myconfig} rtg hurricane{myconfig-rtg} Set IP Default Route hurricane{myconfig-rtg} ipv4_defaultroute hurricane{myconfig-rtg} ipv6_defaultroute 3ffe:1::20 Set static route hurricane{myconfig-rtg} route / hurricane{myconfig-rtg} route 3ffe:30::/48 3ffe:3:: WIND (5) Dynamic Routing Configuration RIP Enter Dynamic Routing Context hurricane{myconfig-rtg} dynamic hurricane{myconfig-rtg-dynamic} Activate RIP Routing Process hurricane{myconfig-rtg-dynamic} router rip hurricane{myconfig-rtg-dynamic-router-rip} network /24 hurricane{myconfig-rtg-dynamic-router-rip} network /24 hurricane{myconfig-rtg-dynamic-router-rip} redistribute connected 38

20 6WIND (6) Dynamic Routing Configuration BGP4+ Enter Dynamic Routing Context hurricane{myconfig-rtg} dynamic hurricane{myconfig-rtg-dynamic} Activate BGP4+ Routing Process hurricane{myconfig-rtg-dynamic} router bgp 10 hurricane{myconfig-rtg-dynamic-router-bgp} neighbor 3ffe:1::20 remote-as 20 hurricane{myconfig-rtg-dynamic-router-bgp} neighbor 3ffe:3::30 remote-as 30 hurricane{myconfig-rtg-dynamic-router-bgp} address-family ipv6 hurricane{myconfig-rtg-dynamic-router-bgp-v6} neighbor 3ffe:1::20 activate hurricane{myconfig-rtg-dynamic-router-bgp-v6} neighbor 3ffe:3::30 activate hurricane{myconfig-rtg-dynamic-router-bgp-v6} redistribute connected 39 FreeBSD Enable IPv6 ipv6_enable="yes" in /etc/rc.conf file Autoconfiguration is automatically done while the gateway function is off Enable IPv6 forwarding ipv6_gateway_enable="yes" in rc.conf file Add an IPv6 address on an interface ifconfig interface inet6 X:X:X:X::X prefixlen 64 40

21 FreeBSD (2) Configure an IPv6 in IPv4 tunnel ifconfig gif1 create ifconfig prefixlen 128 gifconfig ifconfig gif1 up Configure an IPv6 in IPv6 tunnel ifconfig gif1 create ifconfig prefixlen 128 gifconfig ifconfig gif1 up 41 FreeBSD (3) Configure a static route Default route route add -inet6 default fe80::x:x:x:x%interface route add -inet6 default X:X:X:X::X (if global address) Others route add inet6 X:X:X:X:: -prefixlen YY X:X:X:X::X route add inet6 X:X:X:X:: -prefixlen YY fe80::x:x:x:x%interface %interface notation If link-local address, need to specify on which interface the address is available 42

22 FreeBSD (4) RIPng: route6d daemon route6d -L IPv6_prefix,interface (receives only prefixes derived from IPv6_prefix on interface interface) 43 FreeBSD (5) BGB: bgpd daemon Better to use Zebra BGP daemon 44

23 Debian Main URL: Enable IPv6 Put "ipv6" in "/etc/modules" Edit "/etc/network/interfaces" : iface eth0 inet6 static address 2001:XXXX:YYYY:ZZZZ::1 netmask Debian (2) Tunnel configuration Edit "/etc/network/interfaces" : iface tun0 inet6 v4tunnel endpoint A.B.C.D address 2001:XXXX:1:YYYY::2 gateway 2001:XXXX:1:YYYY::1 netmask 64 46

24 Debian (3) RA configuration on a Debian router Add in "/etc/radvd.conf" : interface eth0 { AdvSendAdvert on; AdvLinkMTU 1472; }; prefix 2001:XXXX:YYYY:ZZZZ:/64 { AdvOnLink on; AdvPreferredLifetime 3600; AdvValidLifetime 7200; }; 47 Microsoft (Windows XP) Enable IPv6 ipv6 install in a dos window Auto-configuration is then performed Display IPv6 interfaces ipv6 if Display IPv6 routes ipv6 rt 48

25 Microsoft (Windows XP) (2) Add a static route ipv6 rtu prefix ifindex[/address] [life valid[/pref]] [preference P] [publish] [age] [spl Site Prefix Size] Anonymous addresses ipv6 gpu UseAnonymousAddresses no «User-friendly» IPv6 configuration netsh in a dos window > interface ipv6 49 Zebra Cisco like commands BGP, RIPng, OSPF available 50